CVE-2025-60799: Medium severity phpPgAdmin phpPgAdmin vulnerability
phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability in sql.php at lines 68-76. The application allows unauthorized manipulation of session variables by accepting user-controlled parameters ('subject', 'server', 'database', 'queryid') without proper validation or access control checks. Attackers can exploit this to store arbitrary SQL queries in $SESSION['sqlquery'] by manipulating these parameters, potentially leading to session poisoning, stored cross-site scripting, or unauthorized access to sensitive session data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-60799?
CVE-2025-60799 is classified as a medium severity vulnerability due to the potential for unauthorized manipulation of session variables.
How do I fix CVE-2025-60799?
To fix CVE-2025-60799, upgrade to phpPgAdmin version 7.13.1 or later, where the access control issue has been resolved.
What affected versions are vulnerable to CVE-2025-60799?
CVE-2025-60799 affects phpPgAdmin versions 7.13.0 and earlier.
What types of attack can CVE-2025-60799 enable?
CVE-2025-60799 can enable unauthorized access to sensitive session variables, potentially leading to further exploitation.
Is user input sanitized in CVE-2025-60799?
In CVE-2025-60799, user input is not properly validated or sanitized, allowing for exploitation through manipulated parameters.